# -*- coding: utf-8 -*-

import frida
import sys

# HOOK普通方法、静态方法
jscode = """
Java.perform(function () {
    //com.qianyu.fridaapp.Utils
    var utils = Java.use('com.qianyu.fridaapp.Utils');
    utils.getCalc.implementation = function () {
        console.log("Hook Start...")
        send(arguments[0]);
        send(arguments[1]);
        arguments[1]=100000
        var num=this.getCalc(arguments[0],arguments[1]);
        send(num);
        return 999999;
    }
});
"""

# HOOK构造方法
""" jscode = 
Java.perform(function () {
    //com.qianyu.fridaapp.Money
    var money = Java.use('com.qianyu.fridaapp.Money');
    money.$init.implementation = function () {
        console.log("Hook Start...");
        send(arguments[0]);
        send(arguments[1]);
        
        arguments[0]=9999;
        send(arguments[0]);
        this.$init(arguments[0],arguments[1]);
    }
});
"""

# HOOK重载方法
""" jscode = 
Java.perform(function () {
    var utils = Java.use('com.qianyu.fridaapp.Utils');
    utils.test.overload('int').implementation = function () {
        console.log("Hook Start...");
        send(arguments[0]);
        
        arguments[0]=100000;
        send(arguments[0]);
        
        return this.test();
    }
});
"""

# HOOK构造对象参数
""" jscode = 
Java.perform(function () {
    var utils = Java.use('com.qianyu.fridaapp.Utils');
    var money = Java.use('com.qianyu.fridaapp.Money');
    utils.test.overload().implementation = function () {
        send("Hook Start...");
        // 实例化对象  Money money=new Money(2000,'55');
        var mon = money.$new(2000,'RMB');
        send(mon.getInfo());

        return this.test();
    }
});
"""

# HOOK修改对象属性
"""jscode = 
Java.perform(function () {
    var utils = Java.use('com.qianyu.fridaapp.Utils');
    var money = Java.use('com.qianyu.fridaapp.Money');
    var clazz = Java.use('java.lang.Class');
    utils.test.overload().implementation = function () {
        send("Hook Start...");
        var mon = money.$new(20000,"RMB111");
        send(mon.getInfo());

        var num= Java.cast(mon.getClass(),clazz).getDeclaredField('num');
        num.setAccessible(true);

        num.setInt(mon, 99999);
        send(mon.getInfo());

        return this.test();
    }
});
"""

# HOOK匿名类
"""jscode = 
Java.perform(function () {
    var login = Java.use('com.qianyu.helloworld.LoginActivity$1');
    login.onClick.implementation = function () {
        send("Hook Start...");
        send("yi jin jiao yu!");
    }
});
"""

# HOOK指定类的所有重载方法
"""jscode =  
Java.perform(function() {
    var messageDigest=Java.use('java.security.MessageDigest');
    for(var i = 0; i < messageDigest.digest.overloads.length; i++){
        messageDigest.digest.overloads[i].implementation = function(){
            send(Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Throwable").$new()));
            if(arguments.length == 0){
                send("wu can shu");
                send(this.digest());
                return this.digest();
            }else if(arguments.length == 1){
                send("1111")
                send(arguments[0]);
                send(this.digest(arguments[0]))
                return this.digest(arguments[0]);
            }else if(arguments.length > 1){
                send("22222")
                send(arguments[0]);
                send(arguments[1]);
                send(arguments[2]);
                send(this.digest(arguments[0],arguments[1],arguments[2]));
                return this.digest(arguments[0],arguments[1],arguments[2]);
            }     
        }
    }
});  
"""

# Hook指定类的所有方法
"""jscode = 
Java.perform(function () {
    var utils = Java.use('com.qianyu.fridaapp.Utils');
    var methods = utils.class.getDeclaredMethods();
        for(var j = 0; j < methods.length; j++){
            var methodName = methods[j].getName();
            console.log(methodName);
            for(var k = 0; k < utils[methodName].overloads.length; k++){
                console.log("11111111111"+k);
                utils[methodName].overloads[k].implementation = function(){
                    console.log("2222222222");
                    for(var i = 0; i < arguments.length; i++){
                        console.log(arguments[i]);
                    }
                    return this[methodName].apply(this, arguments);
                }
            }
        }
});
"""

def message(message, data):
    if message["type"] == 'send':
        print("[*] {0}".format(message['payload']))
    else:
        print(message)

process = frida.get_remote_device().attach('com.qianyu.fridaapp')
script = process.create_script(jscode)
script.on("message", message)
script.load()
sys.stdin.read()